1625116 - Assertion failure: isMemberExpression || isCallExpression || isOptionalExpression (Unknown ParseNodeKind for OptionalChain), at js/src/frontend/BytecodeEmitter.cpp:7732

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20200326-3e5a7430c8d7 (build with --enable-debug, run with --fuzzing-safe --no-threads):

`${G}`?.r

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x00005555561c6941 in js::frontend::BytecodeEmitter::emitOptionalTree(js::frontend::ParseNode*, js::frontend::OptionalEmitter&, js::frontend::ValueUsage) ()
#1  0x00005555561c67aa in js::frontend::BytecodeEmitter::emitOptionalTree(js::frontend::ParseNode*, js::frontend::OptionalEmitter&, js::frontend::ValueUsage) ()
#2  0x00005555561ca9eb in js::frontend::BytecodeEmitter::emitOptionalChain(js::frontend::UnaryNode*, js::frontend::ValueUsage) ()
#3  0x00005555561b0322 in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) ()
#4  0x00005555561c5489 in js::frontend::BytecodeEmitter::emitExpressionStatement(js::frontend::UnaryNode*) ()
#5  0x00005555561b057d in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) ()
#6  0x00005555561c5272 in js::frontend::BytecodeEmitter::emitStatementList(js::frontend::ListNode*) ()
#7  0x00005555561b055d in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) ()
#8  0x00005555561b3b90 in js::frontend::BytecodeEmitter::emitScript(js::frontend::ParseNode*) ()
#9  0x00005555561dbf4d in js::frontend::ScriptCompiler<mozilla::Utf8Unit>::compileScript(js::frontend::CompilationInfo&, JS::Handle<JSObject*>, js::frontend::SharedContext*) ()
#10 0x00005555561a2717 in js::frontend::CompileGlobalScript(js::frontend::CompilationInfo&, js::frontend::GlobalSharedContext&, JS::SourceText<mozilla::Utf8Unit>&) ()
#11 0x0000555555b21257 in JSScript* CompileSourceBuffer<mozilla::Utf8Unit>(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<mozilla::Utf8Unit>&) ()
#12 0x0000555555b2164b in JS::CompileUtf8FileDontInflate(JSContext*, JS::ReadOnlyCompileOptions const&, _IO_FILE*) ()
#13 0x00005555557e7f0c in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool) ()
#14 0x00005555557e73c4 in Process(JSContext*, char const*, bool, FileKind) ()
#15 0x000055555578e929 in Shell(JSContext*, js::cli::OptionParser*, char**) ()
#16 0x0000555555786219 in main ()
rax	0x555556f47123	93825019441443
rbx	0x0	0
rcx	0x555557f2d850	93825036114000
rdx	0x0	0
rsi	0x7ffff6efd770	140737336301424
rdi	0x7ffff6efc540	140737336296768
rbp	0x7fffffffa770	140737488332656
rsp	0x7fffffffa720	140737488332576
r8	0x7ffff6efd770	140737336301424
r9	0x7ffff7f9cd00	140737353731328
r10	0x58	88
r11	0x7ffff6ba47a0	140737332791200
r12	0x7ffff5e7c090	140737318994064
r13	0x0	0
r14	0x7fffffffa7e0	140737488332768
r15	0x7fffffffabe8	140737488333800
rip	0x5555561c6941 <js::frontend::BytecodeEmitter::emitOptionalTree(js::frontend::ParseNode*, js::frontend::OptionalEmitter&, js::frontend::ValueUsage)+865>
=> 0x5555561c6941 <_ZN2js8frontend15BytecodeEmitter16emitOptionalTreeEPNS0_9ParseNodeERNS0_15OptionalEmitterENS0_10ValueUsageE+865>:	movl   $0x1e34,0x0
   0x5555561c694c <_ZN2js8frontend15BytecodeEmitter16emitOptionalTreeEPNS0_9ParseNodeERNS0_15OptionalEmitterENS0_10ValueUsageE+876>:	callq  0x55555581199a <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200327094805-2998408f57b1.
Failed to bisect testcase (Start build crashes!):
> Start: 3e5a7430c8d7d87bfeff471e62643185393a34c6 (20200326093308)
> End: 2998408f57b103e0ca4256d55bca54c1f046aca6 (20200327094805)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:

Comment 4

[Yulia Startsev [:yulia] OOO until July 2026]

huh, weird i pushed a patch for this but it never got here for some reason

Comment 5

[Yulia Startsev [:yulia] OOO until July 2026]

Attachment: Bug 1625116 - add templateStringListExpr to list of optionalexprs; r=jorendorff

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d06d14647f6f
add templateStringListExpr to list of optionalexprs; r=jorendorff

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/d06d14647f6f

Comment 8

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200423145559-03626342f6e6.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.